# SumerMoney: reentrancy in repayBorrowBehalf inflates exchange rate

Reentrancy in SumerMoney's repayBorrowBehalf inflates sdrETH exchange rate, letting attacker borrow and drain 350K from lending pools.

- Payout: Real-world hack
- Severity: high
- Program: SumerMoney
- Analysis by: DeFiHackLabs
- Disclosed: 2024-04-12
- Write-up quality: 7/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2024-04/SumerMoney_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20240412-sumermoney
- Tags: domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm tech:solidity vuln:oracle-manipulation vuln:reentrancy

**Target:** Compound-fork lending pool (sdrETH, sdrUSDC, sdrcbETH) on Base
**Root cause:** repayBorrowBehalf increases getCashPrior() before reducing totalBorrows; reentering via receive() during the ETH refund lets attacker borrow against inflated exchange rate.
**Steps:**
1. Flash loan 150 WETH and 645,000 USDC from Balancer.
2. Withdraw WETH to ETH, mint sdrETH with 150 ETH.
3. Deploy Helper with 1 wei; transfer 645k USDC to Helper; call helper.borrow(645k USDC).
4. In Helper.borrow: mint sdrUSDC with USDC, borrow all ETH from sdrETH, then call sdrETH.repayBorrowBehalf{value: borrowAmount+1}.
5. During repayBorrowBehalf, receive() triggers owner.attack() reentrancy.
6. In attack(): borrow all cbETH from sdrcbETH, borrow USDC from sdrUSDC, redeem 150 ETH from sdrETH, claim NFTs 309,310.
7. After reentrancy returns, Helper redeems sdrUSDC, claims NFT 311, transfers USDC to owner.
8. Repay Balancer flash loan.
**Exploitation:** Attacker used a Balancer flash loan to fund the attack, minted sdrETH, then via a helper contract borrowed ETH and called repayBorrowBehalf with 1 wei extra to trigger a reentrancy callback. Inside the callback, the inflated exchange rate (due to cash increase before debt reduction) allowed borrowing all cbETH and USDC from other pools and redeeming sdrETH, then claiming NFTs. Funds were extracted as USDC and cbETH.
**Escalation:** Reentrancy allowed draining multiple lending pools (sdrETH, sdrUSDC, sdrcbETH) and claiming NFTs, amplifying loss to 350K.
**Insight:** In Compound forks, check for reentrancy in repayBorrowBehalf via ETH refund; the exchange rate calculation uses getCashPrior() which can be manipulated mid-transaction if a callback occurs before totalBorrows is reduced.